littlesnitch-linux
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches source code from Objective Development's GitHub repository (
github.com/obdev/littlesnitch-linux) and installs thebpf-linkerutility via Cargo. - [COMMAND_EXECUTION]: Compiles and executes the downloaded Rust code using
cargo buildandcargo runto load eBPF programs into the Linux kernel. - [PRIVILEGE_ESCALATION]: Utilizes
sudoand kernel capabilities (cap_bpf,cap_net_admin) to permit the loading of network monitoring programs into the kernel, which is a required step for eBPF functionality. - [INDIRECT_PROMPT_INJECTION]: Ingests hostnames and IP addresses from local configuration files (
blocked_hosts.txt,blocked_domains.txt) and reads network event data from the kernel perf buffer. The skill includes basic parsing and display of this data for monitoring purposes.
Audit Metadata